{"id":511,"date":"2008-10-17T10:01:40","date_gmt":"2008-10-17T14:01:40","guid":{"rendered":"http:\/\/nuxx.net\/blog\/?p=511"},"modified":"2008-10-17T10:19:50","modified_gmt":"2008-10-17T14:19:50","slug":"restrict-default-ignore","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2008\/10\/17\/restrict-default-ignore\/","title":{"rendered":"restrict default ignore"},"content":{"rendered":"<p>In setting up <a href=\"http:\/\/en.wikipedia.org\/wiki\/Network_Time_Protocol\">NTP<\/a> on <a href=\"https:\/\/nuxx.net\/wiki\/nuxx.net\">nuxx.net<\/a> I ran into a bit of a problem: time wouldn&#8217;t sync. My configuration was fairly simple, following the information on <a href=\"http:\/\/support.ntp.org\">support.ntp.org<\/a> for using the pool of <a href=\"http:\/\/www.pool.ntp.org\/zone\/north-america\">North American<\/a> servers, <a href=\"http:\/\/support.ntp.org\/bin\/view\/Support\/AccessRestrictions#Section_6.5.1.1.2.\">blocking external access<\/a>, but allowing <tt>ntpq<\/tt> (et al) to <a href=\"http:\/\/support.ntp.org\/bin\/view\/Support\/AccessRestrictions#Section_6.5.1.2.1.\">work from localhost<\/a>:<\/p>\n<blockquote>\n<pre><tt>server 0.north-america.pool.ntp.org\r\nserver 1.north-america.pool.ntp.org\r\nserver 2.north-america.pool.ntp.org\r\nserver 3.north-america.pool.ntp.org\r\n\r\ndriftfile \/var\/db\/ntp.drift\r\n\r\nrestrict default ignore\r\nrestrict 127.0.0.1<\/tt><\/pre>\n<\/blockquote>\n<p>However, it seemed that no matter what I tried (disabling the firewall, adding exceptions for TCP\/UDP 123, changing order of the <tt>restrict<\/tt> statements, etc) the box wasn&#8217;t able to contact its peers:<\/p>\n<blockquote>\n<pre><tt>c0nsumer@banstyle:~&gt;&nbsp;ntpq&nbsp;-pn\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;remote&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;refid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;st&nbsp;t&nbsp;when&nbsp;poll&nbsp;reach&nbsp;&nbsp;&nbsp;delay&nbsp;&nbsp;&nbsp;offset&nbsp;&nbsp;jitter\r\n==============================================================================\r\n&nbsp;217.160.254.116&nbsp;.INIT.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;u&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;64&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;4000.00\r\n&nbsp;209.132.176.4&nbsp;&nbsp;&nbsp;.INIT.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;u&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;64&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;4000.00\r\n&nbsp;209.40.97.141&nbsp;&nbsp;&nbsp;.INIT.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;u&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;64&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;4000.00\r\n&nbsp;216.14.98.234&nbsp;&nbsp;&nbsp;.INIT.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16&nbsp;u&nbsp;&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;&nbsp;64&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;&nbsp;&nbsp;&nbsp;0.000&nbsp;4000.00<\/tt><\/pre>\n<\/blockquote>\n<p>After some more digging I found that the <tt>restrict default ignore<\/tt> option, which is widely recommended to keep external folks from connecting to your ntpd, prevents synchronization from happening, even with the exception for localhost.<\/p>\n<p>Having realized that, my <tt>ntp.conf<\/tt> is now just the basic config for the NA servers and the drift file, and it all works great:<\/p>\n<blockquote>\n<pre><tt>server 0.north-america.pool.ntp.org\r\nserver 1.north-america.pool.ntp.org\r\nserver 2.north-america.pool.ntp.org\r\nserver 3.north-america.pool.ntp.org\r\n\r\ndriftfile \/var\/db\/ntp.drift<\/tt><\/pre>\n<\/blockquote>\n<p>Yep, it&#8217;s syncing just fine:<\/p>\n<blockquote>\n<pre><tt>c0nsumer@banstyle:~&gt;&nbsp;ntpq&nbsp;-pn\r\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;remote&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;refid&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;st&nbsp;t&nbsp;when&nbsp;poll&nbsp;reach&nbsp;&nbsp;&nbsp;delay&nbsp;&nbsp;&nbsp;offset&nbsp;&nbsp;jitter\r\n==============================================================================\r\n*217.160.254.116&nbsp;18.26.4.105&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;u&nbsp;&nbsp;200&nbsp;&nbsp;256&nbsp;&nbsp;&nbsp;17&nbsp;&nbsp;&nbsp;37.192&nbsp;&nbsp;&nbsp;&nbsp;4.619&nbsp;&nbsp;&nbsp;1.461\r\n&nbsp;209.132.176.4&nbsp;&nbsp;&nbsp;66.187.233.4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;u&nbsp;&nbsp;201&nbsp;&nbsp;256&nbsp;&nbsp;&nbsp;17&nbsp;&nbsp;101.819&nbsp;&nbsp;&nbsp;21.118&nbsp;&nbsp;&nbsp;9.529\r\n&nbsp;209.40.97.141&nbsp;&nbsp;&nbsp;192.5.41.40&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;u&nbsp;&nbsp;197&nbsp;&nbsp;256&nbsp;&nbsp;&nbsp;17&nbsp;&nbsp;&nbsp;38.565&nbsp;&nbsp;-31.122&nbsp;&nbsp;21.081\r\n&nbsp;216.14.98.234&nbsp;&nbsp;&nbsp;216.218.254.202&nbsp;&nbsp;2&nbsp;u&nbsp;&nbsp;200&nbsp;&nbsp;256&nbsp;&nbsp;&nbsp;17&nbsp;&nbsp;&nbsp;18.731&nbsp;&nbsp;&nbsp;&nbsp;3.940&nbsp;&nbsp;&nbsp;4.848\r\n\r\nc0nsumer@banstyle:~&gt;&nbsp;ntptrace\r\nlocalhost:&nbsp;stratum&nbsp;3,&nbsp;offset&nbsp;0.004619,&nbsp;root&nbsp;distance&nbsp;0.043540\r\nserver.donkeyfly.com:&nbsp;stratum&nbsp;2,&nbsp;offset&nbsp;-0.000686,&nbsp;root&nbsp;distance&nbsp;0.006361\r\nbonehed.lcs.mit.edu:&nbsp;stratum&nbsp;1,&nbsp;offset&nbsp;0.000018,&nbsp;root&nbsp;distance&nbsp;0.000000,&nbsp;refid&nbsp;'CDMA'<\/tt><\/pre>\n<\/blockquote>\n<p>Now I just let <a href=\"http:\/\/en.wikipedia.org\/wiki\/PF_(firewall)\">pf<\/a> restrict access to NTP. That works just fine.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In setting up NTP on nuxx.net I ran into a bit of a problem: time wouldn&#8217;t sync. My configuration was fairly simple, following the information&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/nuxx.net\/blog\/2008\/10\/17\/restrict-default-ignore\/\">Continue reading<span class=\"screen-reader-text\">restrict default ignore<\/span><\/a><\/div>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,4],"tags":[],"class_list":["post-511","post","type-post","status-publish","format-standard","hentry","category-computers","category-nuxxnet","entry"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/511","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=511"}],"version-history":[{"count":14,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/511\/revisions"}],"predecessor-version":[{"id":525,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/511\/revisions\/525"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=511"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=511"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=511"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}